We use cookies to customise content for your subscription and for analytics.If you continue to browse Lexology, we will assume that you are happy to receive all our cookies. For further information please read our Cookie Policy.

Sorry if I'm spamming you, but you do really need to know!** ACMA steps up spam enforcement

For businesses that conduct email marketing, now would be an opportune time to review their procedures and systems to ensure they are not breaching the Spam Act.

In a world where online shopping is the norm, email marketing to customers is a boom area. No longer do businesses compete for customers solely through newspaper, TV and radio advertising. Developing customer loyalty and a one-on-one relationship with customers via email marketing is the new baseline.

Given this focus, complying with the Spam Act should be a priority for every business with an online presence. Often it is taken for granted, but this would be a serious mistake as ACMA has stepped up its enforcement activities in this area. We are seeing investigations and significant financial penalties. Now is an opportune time to review your email marketing activities.

ACMA's recent enforcement action

During the past 12 months, the Australian Communications and Media Authority (ACMA) has taken enforcement action under the Spam Act against large, high profile companies such as Tiger Airways, McDonalds, Groupon and others in relation to their email activities. It has issued infringement notices of $110,000, obtained a court-enforceable behavioural undertaking from one business and issued public formal warnings "naming and shaming" businesses that failed to meet their legal obligations under the Spam Act.

By taking decisive enforcement action, ACMA is not only putting its finite resources to best use but also sounding a warning to business, large and small, to adopt practices and behaviours that comply with the Spam Act or face the financial and reputational consequences.

What are the sorts of activities attracting ACMA's anti-spam enforcement action?

The Spam Act regulates more than just spam emails – it covers a wide range of electronic messages sent by businesses every day (eg. emails, SMS, MMS, faxes). Where these electronic messages contain marketing content, businesses must ensure that these messages are:

sent with the consent of the recipient;

include accurate sender identification details so the sender can be contacted by a recipient; and

include a working unsubscribe link that removes recipients from mailing lists within 5 business days.

to persons whose request to be removed from mailing lists was not actioned (eg. due to faulty unsubscribe facilities);

without an unsubscribe link;

with an unsubscribe link which did not make it clear what the customer was unsubscribing from;

by consumers to their friends using a "send to friends" email facility hosted by a business website. This contravened the Spam Act as the recipients neither consented to receiving the emails, nor were able to unsubscribe.

What are the risks of non-compliance with the Spam Act?

While compliance in this area may not be sexy, it is necessary and both the financial and reputational consequences of failing to comply with the Spam Act are real.

ACMA has broad investigatory and enforcement powers. On the enforcement side, it has the power to seek pecuniary penalties, injunctions and other remedies in Federal Court proceedings, issue infringement notices, obtain court-enforceable behavioural undertakings and issue public formal warnings against non-compliant businesses.

The financial consequences of failing to comply with the Spam Act are serious. For companies with no prior record which contravene the Spam Act two or more times on a given day the maximum pecuniary penalty that the Court may impose is $340,000 per day.

For companies with a prior record which engage in equivalent conduct on a given day, the maximum pecuniary penalty is higher at $1.7 million per day. If ACMA does not decide to start proceedings in the Federal Court, it may opt instead to issue an infringement notice of up to $170,000 for each day a business contravenes the Spam Act 50 or more times in the one day.

Given the frequency of automated emails sent by businesses these days, there is the potential for these figures to multiply quickly if a company has contravened the Spam Act multiple times on multiple days.

What should businesses do?

Because of the different procedures and systems that are often used to send marketing emails between the different business divisions within the same company, ensuring compliance with the Spam Act is often more complex and difficult for large businesses.

This is exacerbated by the inventiveness of marketers, which can outpace the guidance from lawyers in the compliance materials written some years ago. It was almost certainly a factor in some of the breaches described above.

For businesses that conduct email marketing, now would be an opportune time to review the procedures and systems that are used to send marketing emails, and the content of those emails, to ensure compliance with the Spam Act.